In a letter from Senate Commerce Committee Chairman John Thune (R., S.D.) and two subcommittee chairmen, the lawmakers asked Larry Page, Alphabet Inc.’s chief executive, to explain the company’s practice of allowing third-party app developers to scan email contents for commercial purposes. That practice was revealed last week in The Wall Street Journal.

The lawmakers expressed concern that most consumers don’t understand how app developers may be using data from emails including, the letter said, “giving access to personal emails to their employees.” The senators said that Google may not be doing enough to safeguard Gmail data and asked the company to detail all the instances in which app developers have shared Gmail data with third parties.

While Google, a unit of Alphabet, a year ago abandoned the practice of scanning email contents for serving ads, the company continues to let hundreds of outside developers scan the inboxes of Gmail users who signed up for email-based services. Those services commonly use free apps and offers to hook users into giving up access to their inboxes without clearly stating what data they collect and what they are doing with it, current and former employees of these companies told the Journal.

“Ensuring the privacy and security of our users’ data is of the utmost importance,” a Google spokeswoman said. “We look forward to answering the committee’s questions.”

The senators’ letter provides further evidence that congressional leaders are considering legislation in response to a spreading controversy over privacy. The concerns include recent revelations that Facebook Inc. user information was shared with Cambridge Analytica, a data-analytics firm that had ties to Donald Trump’s presidential campaign.

On Tuesday, the U.K. privacy watchdog, the Information Commissioner’s Office, said it intends to levy a £500,000 ($663,000) fine on Facebook for its handling of the matter. The fine, the maximum allowable by the British agency, would mark Facebook’s first financial penalty from an episode that has now buffeted the company for months.

“As we have said before, we should have done more to investigate claims about Cambridge Analytica,” said Facebook Chief Privacy Officer Erin Egan, adding that the company is reviewing the report and will respond soon.

A Cambridge Analytica spokesman has said the company didn’t use Facebook data collected by a psychology professor at the University of Cambridge during the 2016 U.S. presidential election. The firm added that it deleted all data it received from the professor’s company after it became clear there had been violations of Facebook’s policies.

The controversy is now spreading beyond Facebook. A House committee separately on Monday sent letters to Alphabet as well as Apple Inc., asking about a range of privacy practices, including the Gmail issue.

The House lawmakers’ letter to Mr. Page also said recent reports indicate that its Android smartphone operating system collects extensive user-location data and reports it back to Google even when location services are disabled.

One of the signers of Tuesday’s letter, subcommittee Chairman Jerry Moran (R., Kan.), already has said he is considering joining an effort by Sen. Richard Blumenthal (D., Conn.) to draft bipartisan online-privacy legislation.

Tuesday’s letter also says that the Senate committee is considering potential legislation.